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REMARKS 

Claims 1-33 were pending in this application before the amendment as set forth 
above. All claims were finally rejected in the office action mailed May 23, 2006. By this 
Amendment, claims 1, 2, 5, 6, 8, 10, 11, 13-16 are amended, and new dependent claims 
34-37 are introduced. 

The support for amendments can be found in the application as originally filed. 
In particular, the notion of "client/server flow" or "C/S flow" appears on page 8, line 14, 
and more specifically on page 11, lines 4 and 5: "Therefore, a C/S flow can be 
determined by the packets exchanged between the two hosts dealing with the same 
service." 

The notion of "determining" a C/S flow based on predetermined characteristics 
appears on page 10, lines 3-7. 

Applicant appreciates the examiner's reconsideration of the rejection. 

Claim Rejections - 35 U.S.C. SI 02 

In the Office Action dated May 23, 2006, claims 1-22, 30 and 32-33 were 
rejected under 35 U.S.C. § 102(b) as being anticipated by Shipley (U.S. Pat. No. 
6,119,236). 

During the interview, the examiner indicated that the term "flow," as it appeared 
in the claims, was overly broad. The claim amendments presented herein as regards 
client/server (C/S) flows are believed to address the rejection on this ground, and are 
consistent with the discussion during the interview. 

There was discussion during the interview on July 27, 2006 regarding the notion 
of the "concern index" as recited in the claims. The concern index aspect of the claims 
has been present in the claims from the beginning; the claims have been amended (e.g., 
see claim 1) mainly to ensure that the term "concern index" is used consistently. Support 
and explanation for the notion and concept of the concern index, concern index value, 
predetermined concern index characteristic, and accumulated concern index is found in 
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the specification on various pages and various figures, including but not limited to the 
following exemplary passages: 

• FIG. 1 - host data structure 166. 

• Page 10, lines 25-32: 

In accordance with an aspect of the invention, a variable denominated as 
"concern index" (CI) is provided in association with each host identified 
by the intrusion detection engine 155. This concern index CI variable is 
used to accumulate values associated with various abnormal events 
occurring on the network, e.g. when a particular flow is deemed unusual 
or when particular types of anomalous events occur. At such time as the 
cumulated value of the CI variable for a particular host exceeds a 
predetermined threshold value, that host may be considered a sufficient 
threat to warrant generating an alert or alarm and action taken. 

• Page 25, line 18 - description of host data structure 166. 

• FIG. 6 - flow-based CI (concern index) values). 

• FIG. 7 - "CI Event Values" (i.e. "concern index" event values). 

• FIG. 9B- step 945. 

The foregoing comment about concern index is submitted mainly to assist the 
examiner in appreciating that the concern index aspect of the claims provides additional 
points of novelty for the claims, as it is believed that that the claims, as amended, are 
novel and nonobvious. 

In view of the amendments and the discussion during the interview, it is believed 
that the rejection under 35 U.S. C. 102 has been fully addressed and that all claims are 
novel in view of Shipley and the other references of record. It is therefore not believed to 
be necessary to address each and every specific rejection and the basis therefore, as the 
amendments are believed to address all concerns as to patentability on these grounds. 

Claim Rejections - 35 U.S.C. SI 03 

In the Office Action dated May 23, 2006, claims 23-29 and 31 were rejected 
under 35 U.S.C. §103 (a) as being unpatentable over Shipley and further in view of 
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various assertions made by the examiner. 

In view of the amendments and the discussion during the interview, it is believed 
that the obviousness rejection has been fully addressed and that all claims are now novel 
and nonobvious over Shipley and the other references of record. It is therefore not 
believed to be necessary to address each and every specific rejection and the basis 
therefore, as the amendments are believed to address all concerns as to patentability on 
these grounds. 

New claims 34-37 

New dependent claims 34-37 are presented for entry. These claims are fully 
supported in the specification as filed, see FIGS. 6 and 7. Applicant asserts that no new 
matter is added. 



Applicants respectfully submit that the foregoing, in conjunction with the 
contemporaneously filed RCE, is submitted as a full and complete response to the final 
rejection office action mailed May 23, 2006, and is believed to have placed all claims in 
condition for allowance. Accordingly, it is respectfully submitted that this application be 
allowed and that a Notice of Allowance be issued without further delay. If the Examiner 
believes that a further telephone conference with the Applicant's attorneys would be 
advantageous to the disposition of this case, then the Examiner is encouraged to 
telephone the undersigned at 404 504 7720. 



MORRIS, MANNING & MARTIN, LLP 

1600 Atlanta Financial Center 

3343 Peachtree Road, NE 

Atlanta, GA 30326 

(404) 233-7000 

(404) 365-9532 - fax 



CONCLUSION 
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